General
-
Target
79fca6c896273bfe7c8ce9b9024ee69c8b63598d9115084828f87dca5a9c878c
-
Size
944KB
-
Sample
240128-bfxhfagaf8
-
MD5
ede503f703850149cc5c7cbe4ae446dd
-
SHA1
e8500b3aedd270cf3999b3a11d20bbf0fe81acee
-
SHA256
79fca6c896273bfe7c8ce9b9024ee69c8b63598d9115084828f87dca5a9c878c
-
SHA512
90a2b9dde510343226958b0d350295aa97c239b1b91ae90afbaef3bfd8461308fb1b5ddd0c41c021512aa84ec5a1c589afe25b61b612d3912638c41385e2bb40
-
SSDEEP
24576:0c04MROxnFl38um6rrcI0AilFEvxHPSoo+R:0yMir1rrcI0AilFEvxHP
Behavioral task
behavioral1
Sample
79fca6c896273bfe7c8ce9b9024ee69c8b63598d9115084828f87dca5a9c878c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
79fca6c896273bfe7c8ce9b9024ee69c8b63598d9115084828f87dca5a9c878c.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
orcus
192.168.59.201:10134
03e4c751afe746d399e3bb06feda1061
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Targets
-
-
Target
79fca6c896273bfe7c8ce9b9024ee69c8b63598d9115084828f87dca5a9c878c
-
Size
944KB
-
MD5
ede503f703850149cc5c7cbe4ae446dd
-
SHA1
e8500b3aedd270cf3999b3a11d20bbf0fe81acee
-
SHA256
79fca6c896273bfe7c8ce9b9024ee69c8b63598d9115084828f87dca5a9c878c
-
SHA512
90a2b9dde510343226958b0d350295aa97c239b1b91ae90afbaef3bfd8461308fb1b5ddd0c41c021512aa84ec5a1c589afe25b61b612d3912638c41385e2bb40
-
SSDEEP
24576:0c04MROxnFl38um6rrcI0AilFEvxHPSoo+R:0yMir1rrcI0AilFEvxHP
Score10/10-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-